AWS Systems Manager
AWS Systems Manager (SSM) is a service on Amazon Web Services that centralizes operational data from across an AWS and on-premises environment and automates operational tasks at scale. It surfaces operational data, system and application configurations, and software inventory for resources such as Amazon EC2 instances on a single dashboard called Systems Manager Explorer, and it manages secrets and configuration data separately from code through Parameter Store. Administrators can reach servers securely without opening inbound SSH ports using Session Manager, keep servers patched with Patch Manager, and — together with AWS License Manager — manage software licenses on servers hosted outside AWS.
Key points
- Systems Manager Explorer — a single dashboard showing operational data, system and application configurations, software installations, and other details across the environment.
- Parameter Store — a centralized store for secrets and configuration data, keeping them separate from application code.
- Session Manager — a web-console based way to manage servers without logging directly into them; strengthens security and audit posture by restricting incoming SSH access to EC2 instances and removing the need for SSH keys.
- Patch Manager — a Systems Manager capability that automates the process of patching managed nodes with both security-related and other types of updates.
- Systems Manager Distributor — distributes software packages to hosts, including version management.
- SSM Agent — installed on AWS servers and on-premises machines so Systems Manager can communicate with and manage resources across different operating systems.
- Automates repetitive operational and maintenance tasks using predefined playbooks, and helps identify issues in resources that may impact applications.
- ITSM integrations — connects with Jira Service Desk and ServiceNow so ITSM platform users can manage AWS resources.
- Works with AWS License Manager to manage software licenses on physical or virtual servers hosted outside of AWS.
- Unified console (released November 2024) — consolidates Systems Manager’s node, change-management, application, and operations tools into a single centralized experience spanning AWS accounts and Regions, including automated diagnosis and remediation runbooks for nodes that aren’t reporting as managed.
- Parameter Store, Session Manager, Patch Manager, and Distributor remain current, actively supported Systems Manager tools.
- Parameter Store vs AWS Secrets Manager — Parameter Store is free on the standard tier (low-cost on the advanced tier) and suits general configuration data plus secrets that don’t need automatic rotation, but it has no built-in automatic rotation; Secrets Manager costs per secret per month plus API calls, but provides native automatic rotation (e.g. for RDS credentials) and is purpose-built for secrets such as database credentials and API keys.